From 6647be9d34c3a4ae0d014eed6ff4b87884de007b Mon Sep 17 00:00:00 2001 From: Shile Zhang Date: Tue, 18 Jan 2022 19:54:21 +0800 Subject: [PATCH] Revert "bpf: Sanity check max value for var_off stack access" ANBZ: #342 This reverts commit 443226a04d44739197f9d5b0d0bb3f35d885eeb5. Signed-off-by: Qiao Ma Acked-by: Mao Wenan Acked-by: Tony Lu --- kernel/bpf/verifier.c | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index ea6c8c0663ebd3..68dfdfcff2b236 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1834,28 +1834,16 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, if (meta && meta->raw_mode) meta = NULL; - if (reg->smax_value >= BPF_MAX_VAR_OFF || - reg->smax_value <= -BPF_MAX_VAR_OFF) { - verbose(env, "R%d unbounded indirect variable offset stack access\n", - regno); - return -EACCES; - } min_off = reg->smin_value + reg->off; - max_off = reg->smax_value + reg->off; + max_off = reg->umax_value + reg->off; err = __check_stack_boundary(env, regno, min_off, access_size, zero_size_allowed); - if (err) { - verbose(env, "R%d min value is outside of stack bound\n", - regno); + if (err) return err; - } err = __check_stack_boundary(env, regno, max_off, access_size, zero_size_allowed); - if (err) { - verbose(env, "R%d max value is outside of stack bound\n", - regno); + if (err) return err; - } } if (meta && meta->raw_mode) {